IPv6 Up and Running - Address Planning Basics and using a Tunnel Broker

First things first - let’s cover some IPv6 basics.

What’s Different

Many aspects of IPv6 is actually much easier than most people would expect - since there’s such a large addressing space, entire fields of work with IPv6 go away.

Custom CIDR / Subnetting

Remember how you had to do binary math, and use your crystal ball to guess how many hosts will be on any given subnet? Well, if you use CIDR masks from /29 to /19 for individual subnets, that will be replaced with a /64.

A great deal of functionality breaks if you use a subnet mask longer than /64 for generic devices - such as RA/DHCP. When setting up a network for any host-facing network, you need to remember only four masks:

• /64: Use this everywhere
• /126: Use like a /30, but ONLY when interconnecting network devices. You’re not saving space by trying to use this for hosts.
• /127: Use like a /31, but with even more flakey vendor support. This is more space efficient, but you need to verify that ALL of your equipment supports it, or deal with a really fragmented point-to-point prefix.
• /128: Loopbacks

NAT

You don’t need it, because it’s IPv4 duct tape. Prepare yourself for a simpler life without it.

Private Addressing

IPv6 does take a different approach here - there are TWO “private” allocations:

• Link-local addressing (fe80::/10): This addressing allocation is used on a per-segment basis, and pretty much just exists so that every IPv6 speaker will always have an IP address, allowing routing protocols to work on unnumbered interfaces, for example.
• ULA (fc00::/7) Unique local addresses are on the should not be routed list, and should not be used, generally speaking. You have to use NAT Prefix translation to be globally routable, a feature that isn’t well supported. I use this in my spine-and-leaf fabric examples to avoid revealing my publicly allocated prefix, and only in my lab.

Instead, IPv6 architecture focuses on the inverse - allocating prefixes you CAN use. Right now the planet (e.g. Earth, not kidding) has the Global (hehehe) allocation of 2::/3. All IPv6 prefixes are allocated out of this block by providers, using large allocations to ensure easy summarization.

DHCP

DHCPv6 is not mandatory, as SLAAC/RA Configuration can provide any client device with the default gateway and DNS servers. For enterprise applications, however, it is recommended to use DHCPv6 so you don’t unintentionally disclose any information encoded into your IP by SLAAC, and so that your ARP tables aren’t murdered by SLAAC privacy extensions. More here.

DNS

DNS actually isn’t all that different anymore, but still deserves mention for a few reasons.

The first reason why I think it deserves mention is because, as an application, its IPv6 journey was extremely well designed.

• IPv6 Constructs are available, regardless of which “stack” you’re running: Global DNS Servers have a new (ish) record type, AAAA, that indicates that IPv6 is available for any service, and any DNS server should serve AAAA records, even if solicited on IPv6. This is useful in situations where your DNS server may have additional attack surface over IPv6, like Microsoft’s Active Directory servers. It also helps make your migration strategy a bit smoother, as you implement the IPv6 stack progressively throughout your network.

Second, if you don’t have AAAA resolving, IPv6 won’t do much for you.

IPv6 Address Planning

IPv6 address planning is fundamentally different for the reasons listed above, but I do have some general guidelines that help establish a good starting point:

• /48 and /56 are good site prefixes: Since we are using 8x the space in our FIB for each route, allocate a /48 or /56 depending on size per site, but don’t do anything weird like allocating a /63 or a /62 to save space. Keep your sites consistent. A  /56 is the IPv6 equivalent of a /16 in IPv4 - you’ll almost always be right allocating at this length.
• Allocate the last 2 /64s in your prefix for point-to-point prefixes and loopbacks, respectively. It just keeps address fragmentation less messy, and you can summarize the /64s at your backbone to ensure that traceroute “just works”.
• You have lots of space, leave gaps between sites. If you get a /48, you have 255 sites to play with. You can block out entire regions, sites, in a myriad of ways to help your routing table “make sense”.

Here’s how I did it (/48 allocated to me, prefix is masked):

• ffff:ffff:ffff:ffff::/64: Loopbacks
• ffff:ffff:ffff:fffd::/64: Point-to-point links
• ffff:ffff:ffff:e::/49: Allocated to NSX-T, because I don’t have multiple sites in my lab. Don’t do this in the real world, this is for various (messy) experiments with address summarization.
• ffff:ffff:ffff:b::/49: Allocated to the underlay fabric. See above.
• ffff:ffff:ffff:a::/64: Home campus network. This is where Pinterest, and other meatspace activities live.

I’m actually not using much else - I’m allocating large because IPv6 Address shortening makes it easier to type (P.S. IPv4 Address shortening works too, but there are fewer opportunities. Try and ping 1.1) and allocating properly would look like:

• ffff:ffff:ffff::/56 for Site A (Maybe a headquarters location?)
• ffff:ffff:ffff:001::/56 for Site B (Satellite office near HQ?)
• ffff:ffff:ffff:008::/56 for Site C (in another geographic region or state?)
• ffff:ffff:ffff:1::/56 for Site D (HQ in another country?)

Hopefully this is helpful - when in doubt, whiteboard it out.

Well that’s nice, but I’d like to actually do something!

Let’s go through the process of selecting a tunnel broker (this assumes you do not have native IPv6 connectivity, because this would already be done):

Step 1: Search and select the best tunnel broker for you. Since I’m in the United States, I selected Hurricane Electric. I am biased by their educational outreach and certification program. I cannot recommend enough taking a crack at their Sage certification.

Step 2: Sign up using the links provided in the cheat sheet. If possible, ask for a /48 for maximum productivity.

Step 3: Establish a tunnel - I have provided a VyOS template here, but a great deal of networking equipment supports SIT tunneling, so it’s not particularly difficult to set up. Keep in mind that there’s no firewall enabled here, I wouldn’t recommend the same approach, but I’m doing that elsewhere.

Step 4: Start experimenting!